Every year, the same headline runs: researchers publish the year’s most common passwords, and “123456” tops the list. The most recent years have had no exception. Per NordPass’s 2025 Top 200 Most Common Passwords report, based on breach and dark web data collected through September 2025 – “123456” has claimed the #1 spot for the sixth time in seven years NordPass has published this research. “Password” is the only word that’s ever managed to knock it off the top.
Not a clever variation. Not a near-miss. The literal digits one through six, in order. And it’s not an outlier, across every single generation NordPass analyzed, from Gen Z to the Silent Generation, “12345” and “123456” landed at or near the top of the list. Numeric sequences like “1234567” and “1234567890” also ranked high across the board. Age doesn’t predict password quality. Nothing does, really, except habit.
This Isn’t a Knowledge Problem
Most people using ‘123456’ probably don’t believe it’s a strong password. They use it anyway, because six familiar keystrokes are easier than remembering something better. NordPass’s own conclusion, after seven years of running this exact research, states it plainly: despite significant awareness campaigns over the years, the data shows little improvement in password hygiene, and the problem remains as prevalent as ever, suggesting current approaches simply aren’t driving meaningful change.
That’s the real headline. Not simply that ‘123456’ is still #1 but that years of awareness efforts have produced remarkably little change in the exposed-password data.
How Weak Passwords Actually Get Exploited
“Use a strong password” gets treated as one piece of advice, but attackers exploit password weakness through several distinct techniques, each with its own economics:
Brute Force Attacks
Try every possible character combination systematically. Modern cracking tools (Hashcat, John the Ripper) combined with GPU clusters make this brutally fast against short or simple passwords – a six-digit sequence like “123456” falls in a fraction of a second on consumer hardware.
Dictionary Attacks
Skip the brute-force math entirely and just try precompiled lists of real words, common phrases, and known weak passwords pulled from prior breaches. Because so many people reuse the same small set of predictable choices, dictionary lists are effective precisely because human creativity in password-setting is far more limited than people assume.
Credential Stuffing
Doesn’t need to guess the password. It takes username/password pairs already compromised elsewhere and tries them against other services, exploiting credential reuse. This isn’t a rare technique: Verizon’s 2025 Data Breach Investigations Report found credential stuffing made up a median of 19% of all daily authentication attempts across enterprise SSO logs, and identified stolen credentials as the initial access vector in 22% of all confirmed breaches that year.
Password Spraying
Flips the usual approach, instead of trying many passwords against one account, attackers try a small number of common passwords against thousands of accounts at once, staying under the radar of lockout policies designed to catch repeated failures on a single login. This isn’t theoretical: in June 2026, security researchers at Huntress tracked a password-spraying campaign that launched more than 81 million login attempts against Microsoft 365 and Azure CLI accounts over 14 days, successfully compromising at least 78 accounts across 64 organizations. Microsoft’s own 2025 Digital Defense Report found that more than 97% of all identity-based attacks are either password spray or brute-force techniques, meaning the overwhelming majority of account compromises Microsoft observes aren’t sophisticated exploits at all. They’re bulk password guessing, working because enough passwords are still guessable.
Why Training Doesn’t Move the Needle
Every one of these techniques exploits the exact same underlying condition: a human being created a password, and that password is predictable, reused, or both. Security teams have responded with the same playbook for over a decade – complexity requirements, rotation policies, phishing simulations, awareness training. NordPass has published this exact research seven years running, and “123456” has topped it six times. Not because the advice is wrong, but because it depends on changing what millions of individual people do under time pressure, at scale, forever. The lesson isn’t that awareness has no value. It’s that awareness alone has not produced the password behavior we need at scale.
Where the Actual Fix Has to Happen
The only way to close this gap for good is to stop depending on a human to create the secret in the first place. If the employee doesn’t create or possess the authentication secret, human password choice is removed from the equation. That directly changes the conditions exploited by password guessing, spraying and credential reuse.
That’s the architectural shift behind Unixi’s Key Derived Authentication (KDA): the application can continue to receive the authentication material it requires, without requiring the employee to create, know or manage that material themselves. We’ve covered exactly how that works, and what it takes to defend against attacks that target sessions rather than passwords, in more depth here:
- Why Centralizing Passwords Just Centralizes Risk: on why even a well-managed password vault doesn’t solve this
- Beyond Password Vaults: Universal SSO as the Next Evolution of Identity Security: the technical breakdown of how KDA’s four-key derivation works
We Put This to the Test
Numbers on a page are one thing. Watching it happen in real time is another. We asked strangers about their passwords in the video below.
It took just minutes to reconstruct each person’s real password patterns. A hometown and a childhood jersey number, a grandmother’s name and a birthday, a dog’s name and a “lucky number” had people confident that their password was “strong enough.” One person confirmed he uses the exact same password at work. Another mentioned her team shares one password across most of their tools, and that she and her partner keep it saved on a sticky note and in a WhatsApp thread “so we won’t forget.”
None of this took a cracking tool. It took a conversation.
The Real Question
It’s not “how do we get people to stop using 123456.” It’s “why does anyone still have to choose or remember, or share – a password at all?”
As Chad Gerstensang, Unixi CEO puts it at the end of the video: “A password is a key. If you can share it, give it away, someone can steal it from you, or you leave the decision of what to do with it with the employee, they will make a mistake. It’s their mistake but your responsibility.”
Get a free (30 second) assessment to see what reducing dependence on user-managed credentials could look like in your environment.
